Fix memcpy out-of-bounds.

patch by Michel Bardiaux, mbardiaux mediaxim be


git-svn-id: file:///var/local/repositories/ffmpeg/trunk@7780 9553f0bf-9b14-0410-a0b8-cfaf0461ba5b

libavcodec/bmp.c

@@ -187,7 +187,7 @@ static int bmp_decode_frame(AVCodecContext *avctx,
     switch(depth){
     case 24:
         for(i = 0; i < avctx->height; i++){
-            memcpy(ptr, buf, n);
+            memcpy(ptr, buf, avctx->width*(depth>>3));
             buf += n;
             ptr += linesize;
         }